CVE-2018-19361

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-02 · updated 2026-10-15
Weakness: CWE-502

Description

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.

Affected products

Debian Linux: 8.0, 9.0
FasterXML jackson-databind: from 2.6.0 through 2.6.7.2; from 2.7.0 before 2.7.9.5; from 2.8.0 before 2.8.11.3; from 2.9.0 before 2.9.8 — fixed in 2.7.9.5, 2.8.11.3, 2.9.8
Oracle Corporation Oracle Business Process Management Suite: 12.1.3.0.0, 12.2.1.3.0
Oracle Corporation Primavera P6 Enterprise Project Portfolio Management: from 17.7 through 17.12; 15.1, 15.2, 16.1, 16.2, 18.8
Oracle Corporation Primavera Unifier: from 17.7 through 17.12; 16.1, 16.2, 18.8
Oracle Retail Workforce Management Software: 1.60.9.0.0
Oracle Corporation Oracle WebCenter Portal: 12.2.1.3.0
RedHat Automation Manager: 7.3.1
RedHat Decision Manager: 7.3.1
RedHat Jboss Bpm Suite: 6.4.11
Red Hat JBoss BRMS: 6.4.10
Red Hat OpenShift Container Platform 4.18: 3.11

How to fix

Upgrade to a fixed version: FasterXML jackson-databind 2.7.9.5, 2.8.11.3, 2.9.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-19361 or the next vulnerability affects your stack